Conditionals in filter clause

[humartinez]

Hi Im trying to do some conditional processing in the filter section in logstash. The logic is if some field exist do something else other.

if [extended_tweet.full_text] {
   nlp {
      source => "extended_tweet.full_text"
   }
}
else if [quoted_status.extended_tweet.full_text] {
   nlp {
      source => "quoted_status.extended_tweet.full_text"
   }
}
else {
   nlp {
      source => "text"
   }
}

But all the flow goes on the last else. Is there something wrong in this?

[Badger]

@humartinez

if [extended_tweet.full_text] {

Do you mean [extended_tweet][full_text]?

[humartinez]

The field in kibana looks like this 'extended_tweet.full_text' and the type is string should I search it as you post?

[Badger]

If the field name is extended_tweet.full_text, with a dot in the name of the field, then what you have would work. If extended_tweet is an object that contains a full_text field then what I wrote would work. If I recall correctly, both would appear as extended_tweet.full_text in kibana.

[humartinez]

For what im seeing now I guess is an object

      "extended_tweet" : {
        "properties" : {
          "display_text_range" : {
            "type" : "long"
          },
          "entities" : {
            "properties" : {
              "hashtags" : {
                "properties" : {
                  "indices" : {
                    "type" : "long"
                  },
                  "text" : {
                    "type" : "keyword"
                  }
                }
              },
              "media" : {
                "properties" : {
                  "additional_media_info" : {
                    "properties" : {
                      "monetizable" : {
                        "type" : "boolean"
                      }
                    }
                  },
                  "display_url" : {
                    "type" : "keyword"
                  },
                  "expanded_url" : {
                    "type" : "keyword"
                  },
                  "id" : {
                    "type" : "long"
                  },
                  "id_str" : {
                    "type" : "keyword"
                  },
                  "indices" : {
                    "type" : "long"
                  },
                  "media_url" : {
                    "type" : "keyword"
                  },
                  "media_url_https" : {
                    "type" : "keyword"
                  },
                  "sizes" : {
                    "properties" : {
                      "large" : {
                        "properties" : {
                          "h" : {
                            "type" : "long"
                          },
                          "resize" : {
                            "type" : "keyword"
                          },
                          "w" : {
                            "type" : "long"
                          }
                        }
                      },
                      "medium" : {
                        "properties" : {
                          "h" : {
                            "type" : "long"
                          },
                          "resize" : {
                            "type" : "keyword"
                          },
                          "w" : {
                            "type" : "long"
                          }
                        }
                      },
                      "small" : {
                        "properties" : {
                          "h" : {
                            "type" : "long"
                          },
                          "resize" : {
                            "type" : "keyword"
                          },
                          "w" : {
                            "type" : "long"
                          }
                        }
                      },
                      "thumb" : {
                        "properties" : {
                          "h" : {
                            "type" : "long"
                          },
                          "resize" : {
                            "type" : "keyword"
                          },
                          "w" : {
                            "type" : "long"
                          }
                        }
                      }
                    }
                  },
                  "source_status_id" : {
                    "type" : "long"
                  },
                  "source_status_id_str" : {
                    "type" : "keyword"
                  },
                  "source_user_id" : {
                    "type" : "long"
                  },
                  "source_user_id_str" : {
                    "type" : "keyword"
                  },
                  "type" : {
                    "type" : "keyword"
                  },
                  "url" : {
                    "type" : "keyword"
                  },
                  "video_info" : {
                    "properties" : {
                      "aspect_ratio" : {
                        "type" : "long"
                      },
                      "duration_millis" : {
                        "type" : "long"
                      },
                      "variants" : {
                        "properties" : {
                          "bitrate" : {
                            "type" : "long"
                          },
                          "content_type" : {
                            "type" : "keyword"
                          },
                          "url" : {
                            "type" : "keyword"
                          }
                        }
                      }
                    }
                  }
                }
              },
              "urls" : {
                "properties" : {
                  "display_url" : {
                    "type" : "keyword"
                  },
                  "expanded_url" : {
                    "type" : "keyword"
                  },
                  "indices" : {
                    "type" : "long"
                  },
                  "url" : {
                    "type" : "keyword"
                  }
                }
              },
              "user_mentions" : {
                "properties" : {
                  "id" : {
                    "type" : "long"
                  },
                  "id_str" : {
                    "type" : "keyword"
                  },
                  "indices" : {
                    "type" : "long"
                  },
                  "name" : {
                    "type" : "keyword"
                  },
                  "screen_name" : {
                    "type" : "keyword"
                  }
                }
              }
            }
          },